AWS CloudFormation is an Infrastructure as Code (IaC) service that lets you define AWS resources in a text file (a template) and have CloudFormation create, update, and delete those resources for you.

Instead of clicking through the AWS Console or writing imperative scripts, you declare what you want — and CloudFormation handles the how: dependency ordering, parallel creation, rollback on failure.

A CloudFormation template is a YAML (or JSON) file with a defined structure. Here are the key sections — only Resources is required:

AWSTemplateFormatVersion: "2010-09-09"
Description: A simple web server stack

Parameters:
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t3.small, t3.medium]

Resources:
  WebServerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0

  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: ami-0abcdef1234567890
      SecurityGroupIds:
        - !Ref WebServerSG
      UserData:
        Fn::Base64: |
          #!/bin/bash
          yum install -y httpd
          systemctl start httpd

Outputs:
  PublicIP:
    Value: !GetAtt WebServer.PublicIp
    Description: Public IP of the web server

Key things to notice:

• !Ref InstanceType — references the parameter value provided at deploy time
• !Ref WebServerSG — references another resource (CloudFormation resolves the ID)
• !GetAtt WebServer.PublicIp — gets an attribute from a created resource
• CloudFormation creates the Security Group before the EC2 instance (it resolves the dependency automatically)

The Resources section is the heart of every template. Each resource has a logical name, a type, and properties:

CloudFormation provides built-in functions for dynamic values, references, and logic within templates:

CloudFormation provides built-in pseudo parameters that resolve at deploy time — you don't need to define them:

A stack is a single unit of deployment — the collection of AWS resources created from one template. Stacks are the operational unit you interact with.

Stack Creation Flow

Template YAML uploaded

→

CloudFormation Parse & validate

→

Dependency Graph Resolve order

→

Stack Created Resources live

During creation, CloudFormation:

• Validates the template syntax and resource types
• Builds a dependency graph — knows VPC must exist before subnet, subnet before EC2
• Creates resources in parallel where no dependency exists (faster)
• Rolls back all changes if any resource fails to create (all-or-nothing)
• Emits events for each resource (CREATE_IN_PROGRESS → CREATE_COMPLETE or CREATE_FAILED)

When you update a stack, CloudFormation determines how each resource is affected. The impact depends on the property you changed:

When you delete a stack, all resources are deleted by default. But you can override this with a DeletionPolicy:

Parameters make templates reusable by accepting input values at deploy time. Instead of hardcoding an instance type or environment name, you declare a parameter and let the user choose.

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues: [dev, staging, prod]
    Description: Deployment environment

  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t3.small, t3.medium, t3.large]

  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Select an existing EC2 key pair

Mappings are static lookup tables in the template — hardcoded key-value pairs used to select values based on conditions like region or environment. Unlike parameters, mappings are fixed at template authoring time.

Mappings:
  RegionAMI:
    us-east-1:
      HVM64: ami-0abcdef1111111111
    eu-west-1:
      HVM64: ami-0abcdef2222222222
    ap-southeast-1:
      HVM64: ami-0abcdef3333333333

Resources:
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !FindInMap [RegionAMI, !Ref "AWS::Region", HVM64]

The !FindInMap function takes three arguments: map name, first-level key, second-level key. This pattern is most commonly used for region-specific AMI IDs.

Conditions let you create resources or set properties only when certain criteria are met — typically based on parameter values.

Conditions:
  IsProd: !Equals [!Ref Environment, prod]
  CreateReadReplica: !And
    - !Equals [!Ref Environment, prod]
    - !Equals [!Ref EnableReplica, "true"]

Resources:
  ProdAlarm:
    Type: AWS::CloudWatch::Alarm
    Condition: IsProd          # Only created if Environment=prod
    Properties:
      AlarmName: HighCPU
      ...

CloudFormation automatically resolves dependencies when you use !Ref or !GetAtt. But sometimes you need to explicitly declare a dependency that CloudFormation cannot infer:

Resources:
  IGWAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref MyVPC
      InternetGatewayId: !Ref MyIGW

  WebServer:
    Type: AWS::EC2::Instance
    DependsOn: IGWAttachment     # Explicit — wait for IGW attachment
    Properties:
      SubnetId: !Ref PublicSubnet
      ...

Outputs export values from a stack — making them visible in the console and importable by other stacks. This is how you build multi-stack architectures.

# Stack A — Network Stack
Outputs:
  VpcId:
    Value: !Ref MyVPC
    Export:
      Name: NetworkStack-VpcId    # Globally unique export name

# Stack B — App Stack (imports from Stack A)
Resources:
  AppServer:
    Type: AWS::EC2::Instance
    Properties:
      SubnetId: !ImportValue NetworkStack-SubnetId

Nested stacks let you compose templates from reusable child templates. A parent template references child templates stored in S3. Each child becomes a resource of type AWS::CloudFormation::Stack.

A Change Set is a preview of proposed changes before they are applied to a stack. It shows exactly which resources will be added, modified, or replaced — without actually making any changes.

A Stack Policy is a JSON document that protects specific resources from unintended updates. Once applied, CloudFormation denies updates to protected resources unless you explicitly override.

Drift occurs when the actual state of a resource differs from what CloudFormation expects (the template). Someone manually changed a Security Group rule, resized an instance, or modified a bucket policy outside of CloudFormation.

Stack Sets let you deploy a single template across multiple AWS accounts and regions with one operation. Essential for organisations using AWS Organizations.

Termination protection prevents accidental stack deletion. When enabled, any delete-stack call is rejected until protection is explicitly disabled.

CloudFormation can import existing AWS resources (created manually or by other tools) into a stack — without recreating them. This lets you bring unmanaged resources under IaC control.

cfn-init is CloudFormation's built-in configuration management tool. It runs on an EC2 instance at launch time and reads configuration instructions from the template's AWS::CloudFormation::Init metadata — installing packages, writing files, starting services, and more.

cfn-signal tells CloudFormation whether an instance successfully completed configuration. Without it, CloudFormation marks an EC2 instance as CREATE_COMPLETE the moment it launches — even if cfn-init hasn't finished or failed.

Custom Resources let you extend CloudFormation beyond its built-in resource types. They invoke a Lambda function (or SNS topic) during stack create/update/delete — allowing you to do anything that AWS APIs can do.

In production, you should never put everything in one giant stack. Split your infrastructure into layered, loosely coupled stacks with independent lifecycles.

CloudFormation integrates naturally into CI/CD pipelines for automated infrastructure deployment: